import { OAuthProfile, OAuthTokens } from "./providers/OAuthProvider";
/**
 * OAuth error information
 */
export interface OAuthError {
    code: string;
    message: string;
    details?: any;
}
/**
 * Response from onAuthSuccess callback
 * Must include JWT token generated by the application
 */
export interface AuthSuccessCallbackResponse {
    user: any;
    token: string;
    redirectUrl?: string;
}
/**
 * Response from onAuthError callback
 */
export interface AuthErrorCallbackResponse {
    redirectUrl?: string;
}
/**
 * Configuration options for OAuth Plugin with JWT integration
 *
 * The plugin depends on @flink-app/jwt-auth-plugin being installed and configured.
 * The onAuthSuccess callback receives the Flink context as a second parameter,
 * allowing the application to generate JWT tokens using ctx.plugins.jwtAuth.createToken().
 */
export interface OAuthPluginOptions {
    /**
     * OAuth provider configurations
     * At least one provider must be configured
     */
    providers: {
        github?: {
            clientId: string;
            clientSecret: string;
            callbackUrl: string;
            scope?: string[];
        };
        google?: {
            clientId: string;
            clientSecret: string;
            callbackUrl: string;
            scope?: string[];
        };
    };
    /**
     * Whether to store OAuth tokens for future API access
     * If false, tokens are discarded after authentication
     * Default: false
     */
    storeTokens?: boolean;
    /**
     * Callback invoked after successful OAuth authentication
     *
     * Application responsibilities:
     * 1. Find or create user based on OAuth profile
     * 2. Link OAuth provider to user account
     * 3. Generate JWT token using ctx.plugins.jwtAuth.createToken(payload, roles)
     * 4. Return user object, JWT token, and optional redirect URL
     *
     * @param params - OAuth profile, provider name, and tokens (if storeTokens enabled)
     * @param ctx - Flink context with access to repos and plugins (including jwtAuth)
     * @returns User object, JWT token, and optional redirect URL
     */
    onAuthSuccess: (params: {
        profile: OAuthProfile;
        provider: "github" | "google";
        tokens?: OAuthTokens;
    }, ctx: any) => Promise<AuthSuccessCallbackResponse>;
    /**
     * Callback invoked on OAuth errors
     *
     * Application responsibilities:
     * - Log error for debugging
     * - Optionally provide redirect URL for error page
     *
     * @param params - Error information and provider name
     * @returns Optional redirect URL for error page
     */
    onAuthError?: (params: {
        error: OAuthError;
        provider: "github" | "google";
    }) => Promise<AuthErrorCallbackResponse>;
    /**
     * Custom collection name for OAuth sessions
     * Default: 'oauth_sessions'
     */
    sessionsCollectionName?: string;
    /**
     * Custom collection name for OAuth connections (if storeTokens enabled)
     * Default: 'oauth_connections'
     */
    connectionsCollectionName?: string;
    /**
     * Session TTL in seconds
     * Sessions are automatically cleaned up after this duration
     * Default: 600 (10 minutes)
     */
    sessionTTL?: number;
    /**
     * Encryption key for encrypting stored OAuth tokens
     * If not provided, will be derived from first configured provider's client secret
     * Recommended: Use a dedicated encryption key from environment variables
     */
    encryptionKey?: string;
    /**
     * Whether to register OAuth routes automatically
     * If false, you must manually handle OAuth flow
     * Default: true
     */
    registerRoutes?: boolean;
}